joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001334c0
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push r15
sub rsp, 0xa0
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
xor eax, eax
mov dword [rsp + 0x40], eax
mov rbx, qword [rsp + 0xd8]
mov dword [rbx], eax
xor edx, edx
lea rax, [0x100062180]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [r11 - 0x30]
call fcn.10005b410
nop
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, 1
mov rdx, rsi
mov rcx, r14
call qword [r15 + 0x58]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call fcn.10005b4f0
nop
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x100133588
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100133599
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1001335d0
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1001335c9
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1001335de
call fcn.1000618f0
mov eax, dword [rsp + 0x40]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret

Function at 0x100133610
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10013367f
mov eax, dword [rsp + 0x24]
cmp eax, 5
jb 0x10013367f
jne 0x100133652
cmp dword [rsp + 0x28], 1
jb 0x10013367f
movzx eax, byte [rsp + 0x13a]
cmp al, 3
je 0x100133662
cmp al, 2
jne 0x10013367f
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x158
ret
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x158
ret
Function at 0x1001357a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
mov eax, dword [rcx + 0x2fc08]
mov rdi, rdx
mov r10d, r9d
and r10d, 3
mov r14, rdx
mov edx, r9d
sub edx, r10d
mov ebx, r9d
mov r11, r8
add dword [rcx + 0x2fc0c], ebx
add rdi, rdx
mov rsi, rcx
not eax
mov r15, r8
lea r10, [0x10003b050]
cmp r9d, 3
jbe 0x100135886
add r9d, 0xfffffffc
shr r9d, 2
inc r9d
nop word [rax + rax]
mov ecx, dword [r15]
add r14, 4
add r15, 4
mov dword [r14 - 4], ecx
movzx edx, byte [r11]
mov ecx, eax
xor rdx, rcx
shr eax, 8
add r11, 4
movzx ecx, dl
add ebx, 0xfffffffc
mov edx, dword [r10 + rcx*4]
movzx ecx, byte [r11 - 3]
xor edx, eax
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r10 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r10 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov eax, dword [r10 + rax*4]
xor eax, edx
dec r9
jne 0x100135810
test ebx, ebx
je 0x1001358bf
sub rdi, r11
nop dword [rax]
movzx ecx, byte [r11]
inc r11
mov byte [rdi + r11 - 1], cl
movzx r9d, byte [r11 - 1]
mov ecx, eax
mov edx, r9d
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [r10 + r8*4]
mov byte [rdi + r11 - 1], r9b
xor eax, ecx
dec ebx
jne 0x100135890
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
not eax
mov dword [rsi + 0x2fc08], eax
mov rsi, qword [rsp + 0x18]
pop r15
ret
Function at 0x10013ddf0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
cmp qword [rcx + 0xe8], 0
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r14
mov ebp, r8d
mov rdi, rcx
mov r14d, edx
je 0x10013deb8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013de4f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10013de60
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10013de97
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013de90
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x210]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp qword [rdi + 0xe8], rax
je 0x10013deb8
mov ecx, 1
jmp 0x10013deba
xor ecx, ecx
xor eax, eax
test ecx, ecx
lea rdx, [0x100241358]
cmovne rax, rdi
lea r9, [rsp + 0x20]
mov r8d, ebp
mov qword [rsp + 0x28], rax
xor eax, eax
test ecx, ecx
cmovne rax, rdx
lea rcx, [rdi + 0x128]
mov edx, r14d
mov dword [rsp + 0x20], 0x4000d5
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], rax
call fcn.100141810
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
cmp eax, 0x102
ja 0x10013df5a
je 0x10013df50
test eax, eax
je 0x10013df49
sub eax, 2
je 0x10013df35
dec eax
je 0x10013df3f
dec eax
jne 0x10013df6f
mov eax, 0x80131021
add rsp, 0x58
ret
mov eax, 0x80131020
add rsp, 0x58
ret
xor eax, eax
add rsp, 0x58
ret
mov eax, 0x80131024
add rsp, 0x58
ret
cmp eax, 0x80000000
je 0x10013df83
cmp eax, 0xc0000000
je 0x10013df79
cmp eax, 0xe0000000
je 0x10013df79
mov eax, 0x8000ffff
add rsp, 0x58
ret
mov eax, 0x8007000e
add rsp, 0x58
ret
mov eax, 0x80004005
add rsp, 0x58
ret

Function at 0x10013e1e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013e215
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x10013e222
call fcn.10013e700
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10013e240
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov esi, r8d
mov rbp, rdx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013e285
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
call fcn.100140640
test eax, eax
jne 0x10013e292
test esi, esi
je 0x10013e2d6
mov rax, qword [rbx + 0x100]
test rax, rax
jne 0x10013e2ad
mov rcx, rbx
call fcn.1000648e0
mov rax, qword [rbx + 0x100]
lea rcx, [0x10005b680]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
call fcn.1001406e0
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x10013e5b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x68]
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x10013e5f8
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x10013e609
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x10013e640
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x10013e639
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
mov rsi, qword [rax + 0x210]
mov eax, dword [rbx + 0x24]
cmp eax, 1
je 0x10013e65a
mov rdx, rsi
mov rcx, rbx
call fcn.10013e540
mov rax, qword [rbx]
mov rcx, rbx
mov dword [rbx + 0xdc], 1
call qword [rax + reloc.WS2_32.dll_htonl]
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rsi + 0x90], edx
je 0x10013e68c
lea rcx, [rsi + 0x90]
call fcn.100057ac0
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x10013e6b7
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
mov rbp, qword [rsp + 0x40]
mov qword [rdi], rbx
mov rax, qword [rax + 0x38]
mov qword [rax], rbx
mov dword [rsi + 0x90], 0
mov rsi, qword [rsp + 0x48]
mov dword [rbx + 0x24], 2
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x10013ec00
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x168], 0
mov rdi, rcx
je 0x10013ec1d
mov eax, 0x80131022
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ec52
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10013ec63
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10013ec9a
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ec93
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov eax, dword [rax + 0x220]
and eax, 1
mov dword [rdi + 0x164], eax
jne 0x10013ed25
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ecd6
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10013ece7
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10013ed1e
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ed17
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
or dword [rax + 0x220], 1
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov dword [rdi + 0x168], 1
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013fdf5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
test rcx, rcx
jne 0x10013fe1b
call fcn.100058b00
xor edx, edx
mov ecx, 0x80131022
test eax, eax
cmovne ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x10013ec00
Function at 0x10013ed50
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x168], 0
mov rdi, rcx
jne 0x10013ed6d
mov eax, 0x80131022
add rsp, 0x20
pop rdi
ret
cmp dword [rcx + 0x164], 0
jne 0x10013ee1e
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013edaf
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10013edc0
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10013edf7
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013edf0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov ecx, dword [rax + 0x220]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov edx, ecx
xor edx, 1
and edx, ecx
mov dword [rax + 0x220], edx
mov dword [rdi + 0x168], 0
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013fe65
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
test rcx, rcx
jne 0x10013fe8b
call fcn.100058b00
xor edx, edx
mov ecx, 0x80131022
test eax, eax
cmovne ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x10013ed50

Function at 0x10013f760
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013f7a5
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx]
test rbx, rbx
je 0x10013f7b8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x10013f7ea
call fcn.100058b00
test eax, eax
je 0x10013f7ed
call fcn.100059080
mov ecx, dword [rax + 0xe8]
cmp ecx, 7
je 0x10013f7ed
mov rcx, qword [rbp + 0x10]
call fcn.10013f2b0
mov rbx, rax
test rax, rax
je 0x10013f7ed
mov rcx, rax
call fcn.10013e5b0
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x10013f900
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov ebx, r8d
mov esi, edx
test edx, edx
jne 0x10013f9e4
call fcn.1001494e0
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10013f956
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10013f967
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10013f99e
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x10013f997
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, qword [rcx + 0x2f8]
cmp rax, r8
ja 0x10013f9d8
mov rdx, r8
sub rdx, rax
mov rax, qword [rcx + 0x218]
cmp rdx, qword [rax + 0xab0]
jbe 0x10013f9dd
movabs rax, 0x7fffffffffffffff
cmp r8, rax
je 0x10013f9dd
call fcn.1000655c0
xor edi, edi
jmp 0x10013fa99
lea rcx, [rsp + 0x28]
call fcn.1001493f0
nop
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.100149450
mov ebx, eax
xor edi, edi
test eax, eax
jne 0x10013fa2d
mov dword [rsp + 0x38], 0x400069
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x38]
mov ecx, esi
call fcn.100058870
mov ebx, eax
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.1001494b0
cmp ebx, 0x102
ja 0x10013fa64
je 0x10013fa8f
test ebx, ebx
je 0x10013fa8f
sub ebx, 2
je 0x10013fa5d
dec ebx
je 0x10013fa56
dec ebx
je 0x10013fa5d
jmp 0x10013fa7c
mov edi, 0x80131020
jmp 0x10013fa8f
mov edi, 0x80131021
jmp 0x10013fa8f
cmp ebx, 0x80000000
je 0x10013fa8a
cmp ebx, 0xc0000000
je 0x10013fa83
cmp ebx, 0xe0000000
je 0x10013fa83
mov edi, 0x8000ffff
jmp 0x10013fa8f
mov edi, 0x8007000e
jmp 0x10013fa8f
mov edi, 0x80004005
lea rcx, [rsp + 0x28]
call fcn.100149420
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x10013fcd0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013fd05
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx]
cmp byte [rbx + 0x1330], 0
jne 0x10013fd34
cmp dword [rbx + 0x16c], 0
jne 0x10013fd2e
call fcn.100058b00
mov dword [rbx + 0x170], eax
test eax, eax
jne 0x10013fd2e
call fcn.1000589b0
inc dword [rbx + 0x16c]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10013fd50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013fd85
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx]
cmp byte [rax + 0x1330], 0
jne 0x10013fda7
dec dword [rax + 0x16c]
jne 0x10013fda7
cmp dword [rax + 0x170], 0
jne 0x10013fda7
call fcn.100058a50
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x10013fdc0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x168], 0
mov rdi, rcx
je 0x10013ec1d
mov eax, 0x80131022
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ec52
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10013ec63
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10013ec9a
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ec93
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov eax, dword [rax + 0x220]
and eax, 1
mov dword [rdi + 0x164], eax
jne 0x10013ed25
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ecd6
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10013ece7
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10013ed1e
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ed17
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
or dword [rax + 0x220], 1
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov dword [rdi + 0x168], 1
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013fdf5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
test rcx, rcx
jne 0x10013fe1b
call fcn.100058b00
xor edx, edx
mov ecx, 0x80131022
test eax, eax
cmovne ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x10013ec00
Function at 0x10013fe30
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x168], 0
mov rdi, rcx
jne 0x10013ed6d
mov eax, 0x80131022
add rsp, 0x20
pop rdi
ret
cmp dword [rcx + 0x164], 0
jne 0x10013ee1e
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013edaf
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10013edc0
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10013edf7
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013edf0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov ecx, dword [rax + 0x220]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov edx, ecx
xor edx, 1
and edx, ecx
mov dword [rax + 0x220], edx
mov dword [rdi + 0x168], 0
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013fe65
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
test rcx, rcx
jne 0x10013fe8b
call fcn.100058b00
xor edx, edx
mov ecx, 0x80131022
test eax, eax
cmovne ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x10013ed50

Function at 0x10013fea0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013fed5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx]
test rbx, rbx
jne 0x10013fefb
call fcn.100058b00
xor edx, edx
mov ecx, 0x8000ffff
test eax, eax
cmovne ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [rbx + 0x174], 0
jne 0x10013ff18
call fcn.100058b00
mov dword [rbx + 0x178], eax
test eax, eax
jne 0x10013ff18
call fcn.1000589b0
inc dword [rbx + 0x174]
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x10013ff40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10013ff75
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx]
test rcx, rcx
jne 0x10013ff9b
call fcn.100058b00
xor ebx, ebx
mov ecx, 0x8000ffff
test eax, eax
cmovne ecx, ebx
mov eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rcx + 0x174]
xor ebx, ebx
test eax, eax
jg 0x10013ffb9
mov ebx, 0x80131022
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec eax
mov dword [rcx + 0x174], eax
jne 0x10013ffeb
cmp dword [rcx + 0x178], ebx
jne 0x10013ffeb
call fcn.100058b00
test eax, eax
je 0x10013ffe6
call fcn.100058a50
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ebx, 0x8000ffff
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100140640
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100140675
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100140686
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1001406bd
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1001406b6
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov eax, dword [rax + 0x2d8]
mov rbx, qword [rsp + 0x30]
shr eax, 3
and eax, 1
add rsp, 0x20
pop rdi
ret