Function at 0x140002ee0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x1a0
mov r14d, r9d
mov r13, r8
mov r12, rdx
mov r15, rcx
xor ebx, ebx
mov esi, ebx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp - 0x78], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp - 0x18], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp - 0x70], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp - 0x20], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp + 0x10], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp + 0x30], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp + 0x28], rax
mov word [rax], bx
lea ecx, [rbx + 2]
call fcn.1400e8270
mov qword [rbp + 8], rax
mov word [rax], bx
movzx edi, byte [rbp + 0xf0]
cmp r14d, 0xffffffff
jne 0x1400031e8
mov qword [rbp - 0x28], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x30], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x80], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x38], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x40], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x48], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x50], rbx
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x58], rbx
lea rbx, [0x14011eaa0]
test r13, r13
cmovne rbx, r13
mov rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x58], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x58]
mov rdx, r12
lea rcx, [rbp - 8]
call fcn.14000b540
mov rdi, rax
xor r14d, r14d
mov qword [rbp - 0x60], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x60], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x68], r14
mov rcx, rbx
call fcn.1400e81d8
mov qword [rbp - 0x68], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x68]
mov rdx, r12
lea rcx, [rbp]
call fcn.14000b540
nop
movzx ecx, byte [rbp + 0xf0]
mov dword [rsp + 0x80], 0xffffffff
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rbx
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x58], rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
lea r8d, [r14 - 1]
mov rcx, r15
call fcn.140005d90
mov r14d, eax
mov rcx, qword [rbp]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 8]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x50]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x40]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x30]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400e825c
movzx edi, byte [rbp + 0xf0]
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call fcn.140009290
test eax, eax
jne 0x1400038bd
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, qword [rbp - 0x10]
call fcn.140018f50
test eax, eax
jne 0x1400038b2
mov ecx, dword [0x140178818]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x10]
call fcn.140009290
test eax, eax
jne 0x14000388f
lea r8, [rbp - 0x18]
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x10]
call fcn.140019220
test eax, eax
jne 0x140003885
mov rax, qword [rbp - 0x78]
mov word [rax], bx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ShellComponent
mov rcx, qword [rbp + 0x20]
call fcn.140019160
test eax, eax
jne 0x1400032b4
mov rax, qword [rbp - 0x78]
cmp word [rax], 0
jne 0x1400032e1
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.StubPath
mov rcx, qword [rbp + 0x20]
call fcn.140019160
mov rax, qword [rbp - 0x78]
cmp word [rax], 0
je 0x140003885
mov rbx, qword [rbp - 0x18]
cmp word [rbx], 0
jne 0x140003303
lea rcx, [0x14011eae0]
call fcn.1400e81d8
mov qword [rbp - 0x18], rax
mov rcx, rbx
call fcn.1400e825c
mov ecx, 2
call fcn.1400e8270
mov qword [rbp + 0x38], rax
xor ecx, ecx
mov word [rax], cx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rcx
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp - 0x78]
call fcn.14000a050
mov rax, qword [rbp - 0x78]
mov rbx, qword [rbp + 8]
lea rcx, [0x14011eaa0]
test rax, rax
cmovne rcx, rax
call fcn.1400e81d8
mov qword [rbp + 8], rax
mov rcx, rbx
call fcn.1400e825c
xor r9d, r9d
lea r8, [rbp + 0x38]
mov rdx, r15
lea rcx, [rbp + 0x58]
call fcn.140007340
mov rdx, qword [rax]
mov rbx, qword [rbp - 0x20]
lea rcx, [0x14011eaa0]
test rdx, rdx
cmovne rcx, rdx
call fcn.1400e81d8
mov qword [rbp - 0x20], rax
mov rcx, rbx
call fcn.1400e825c
mov rcx, qword [rbp + 0x58]
call fcn.1400e825c
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x10]
mov rdx, qword [rbp - 0x20]
mov rcx, r15
call fcn.140007330
mov r13d, eax
mov qword [rbp - 0x80], 0
lea r15, [0x14011eaa0]
mov rax, qword [rbp + 0xe0]
test rax, rax
cmovne r15, rax
mov rcx, r15
call fcn.1400e81d8
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x80]
mov rdx, r12
lea rcx, [rbp + 0x68]
call fcn.14000b540
mov rbx, rax
mov qword [rbp - 0x30], 0
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x30], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x28], 0
mov rcx, r15
call fcn.1400e81d8
mov qword [rbp - 0x28], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x28]
mov rdx, r12
lea rcx, [rbp + 0x60]
call fcn.14000b540
nop
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x18]
mov r8, rbx
mov rdx, rax
mov rcx, qword [rbp + 0xd0]
call fcn.1400058c0
movzx ebx, al
mov rcx, qword [rbp + 0x60]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x30]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400e825c
test bl, bl
je 0x1400037fe
cmp r14d, 0xffffffff
jne 0x1400036fd
xor r14d, r14d
mov qword [rbp - 0x80], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 8], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 8], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp + 0x18], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp + 0x18], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x68], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x68], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x60], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x60], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x58], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x58], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x50], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x48], r14
mov rcx, r15
call fcn.1400e81d8
mov qword [rbp - 0x48], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x48]
mov rdx, r12
lea rcx, [rbp + 0x78]
call fcn.14000b540
mov rbx, rax
mov qword [rbp - 0x40], r14
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x40], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov qword [rbp - 0x38], r14
mov rcx, r15
call fcn.1400e81d8
mov qword [rbp - 0x38], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x38]
mov rdx, r12
lea rcx, [rbp + 0x70]
call fcn.14000b540
nop
movzx edi, dil
mov dword [rsp + 0x80], 0xffffffff
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x58], r14
lea rcx, [rbp - 8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
lea r8d, [r14 - 1]
mov rcx, qword [rbp + 0xd0]
call fcn.140005d90
mov r14d, eax
mov rcx, qword [rbp + 0x70]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x38]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x40]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x78]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x50]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x60]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x18]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 8]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400e825c
jmp 0x140003701
movzx edi, dil
mov qword [rbp - 0x80], 0
lea rcx, [0x14011eaa0]
call fcn.1400e81d8
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.1400e825c
nop
mov rbx, qword [rbp + 0x80]
mov qword [rbp], 0
mov rcx, r15
call fcn.1400e81d8
mov qword [rbp], rax
xor ecx, ecx
call fcn.1400e825c
nop
lea r9, [rbp - 0x70]
lea r8, [rbp]
mov rdx, r12
lea rcx, [rbp + 0x88]
call fcn.14000b540
nop
mov dword [rsp + 0x80], 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x58], rbx
lea rcx, [rbp + 8]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, r14d
mov edx, r13d
mov r15, qword [rbp + 0xd0]
mov rcx, r15
call fcn.140005d90
nop
mov rcx, qword [rbp + 0x88]
call fcn.1400e825c
nop
mov rcx, qword [rbp]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400e825c
jmp 0x140003805
mov r15, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x14000387c
mov rdi, qword [rbp + 0x48]
cmp rbx, rdi
je 0x14000382c
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, rdi
jne 0x140003817
mov rbx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x50]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140003864
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000392a
mov rcx, rbx
call fcn.1400e0fb8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x38]
call fcn.1400e825c
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
lea r8, [rbp - 0x70]
mov edx, esi
mov rcx, qword [rbp - 0x10]
call fcn.140018f50
test eax, eax
jne 0x1400038b2
movzx edi, byte [rbp + 0xf0]
xor ebx, ebx
jmp 0x140003232
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 8]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x28]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x30]
call fcn.1400e825c
nop
mov rcx, qword [rbp + 0x10]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x20]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x18]
call fcn.1400e825c
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400e825c
mov eax, r14d
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e8160
nop
push rdi
push r14
sub rsp, 0x28
mov rdi, qword [rcx]
mov r14, rcx
test rdi, rdi
je 0x140003a3c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rbp, qword [rcx + 8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r15
xor r15d, r15d
cmp rdi, rbp
je 0x1400039e9
nop dword [rax + rax]
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400039d8
mov rsi, qword [rdi + 0x10]
cmp rbx, rsi
je 0x140003993
mov rcx, qword [rbx]
call fcn.1400e825c
add rbx, 8
cmp rbx, rsi
jne 0x140003982
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi + 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400039c7
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003a44
mov rcx, r8
call fcn.1400e0fb8
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
mov rcx, qword [rdi]
call fcn.1400e825c
add rdi, 0x20
cmp rdi, rbp
jne 0x140003970
mov rcx, qword [r14]
mov rdx, qword [r14 + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x140003a18
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003a44
mov rcx, r8
call fcn.1400e0fb8
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [r14], r15
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], r15
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
ret
call fcn.1400e8160
int3