Function at 0x140008210
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp], rax
mov byte [rsp + 0x40], r9b
mov rdi, r8
mov qword [rsp + 0x68], r8
mov qword [rbp - 0x60], rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
mov dword [rbp - 0x20], esi
mov rcx, qword [r8 + 0x10]
sub rcx, qword [r8 + 8]
test rcx, 0xfffffffffffffff8
jne 0x14000827d
lea rcx, str._bad_command_
call fcn.1400a8238
mov qword [rbx], rax
mov rax, rbx
jmp 0x140008ea2
mov rax, qword [r8 + 8]
mov rcx, qword [rax]
call fcn.1400a8238
mov qword [rbp - 0x58], rax
mov ecx, 2
call fcn.1400a82f0
mov qword [rsp + 0x30], rax
mov word [rax], si
mov ecx, 2
call fcn.1400a82f0
mov qword [rsp + 0x50], rax
mov word [rax], si
mov ecx, 2
call fcn.1400a82f0
mov qword [rbp - 0x68], rax
mov word [rax], si
mov ecx, 2
call fcn.1400a82f0
mov rbx, rax
mov word [rax], si
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0x200
mov rcx, qword [0x140125bf0]
je 0x1400082f3
mov rcx, qword [0x140125be8]
call fcn.1400a8238
mov rsi, rax
mov qword [rbp - 0x18], rax
mov rcx, rbx
call fcn.1400a82b0
mov rax, qword [rdi + 8]
mov rcx, qword [rax]
call fcn.1400a8238
mov rbx, rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x28], rax
mov rcx, rax
call fcn.1400a8238
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.1400aa394
mov r8d, 4
lea rdx, [0x1400d2368]
mov rcx, qword [rsp + 0x48]
call fcn.1400a9818
test eax, eax
jne 0x140008357
lea rcx, [rbx + 8]
jmp 0x14000841c
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.SYSTEMROOT_
mov rcx, qword [rsp + 0x48]
call fcn.1400a9818
test eax, eax
jne 0x140008419
mov rbx, qword [rsp + 0x30]
lea rcx, [0x140124ec0]
call fcn.1400a8238
mov qword [rsp + 0x30], rax
mov rcx, rbx
call fcn.1400a82b0
mov rcx, qword [rsp + 0x30]
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1400083a0
mov ebx, 0x7fffffff
cmp rdi, rbx
cmovb rbx, rdi
lea rdx, [rdi*2 + 6]
call fcn.1400a83a8
mov qword [rsp + 0x30], rax
sub rdi, rbx
lea r8, [rdi*2 + 2]
lea rdx, [rax + rbx*2]
lea rcx, [rax + 2]
lea rcx, [rcx + rbx*2]
call fcn.1400a7cd0
mov rax, qword [rsp + 0x30]
lea rcx, [rax + rbx*2]
movzx eax, word [0x1400d1c90]
mov word [rcx], ax
mov rdx, qword [rbp - 0x80]
add rdx, 0x18
xor r9d, r9d
mov r8d, 0x7fffffff
lea rcx, [rsp + 0x30]
call fcn.140002620
mov rcx, qword [rsp + 0x30]
jmp 0x14000841c
mov rcx, rbx
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400a82b0
mov rcx, rdi
call fcn.1400a8238
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rcx, rax
call fcn.1400aa394
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0x200
jne 0x14000854c
lea rdx, str._PROGRAMFILES_
mov rcx, rbx
call fcn.1400a99c0
test rax, rax
je 0x1400084d2
lea rdx, str._PROGRAMFILES_
mov rcx, rbx
call fcn.1400a99c0
sub rax, rbx
sar rax, 1
mov ecx, eax
movups xmm0, xmmword [str._ProgramW6432_]
movups xmmword [rdi + rcx*2], xmm0
movsd xmm1, qword [0x1400d2188]
movsd qword [rdi + rcx*2 + 0x10], xmm1
mov eax, dword [0x1400d2190]
mov dword [rdi + rcx*2 + 0x18], eax
add rcx, 0xe
lea rdx, [rdi + rcx*2]
mov rcx, rdx
sub rcx, rdx
nop dword [rax]
movzx eax, word [rdx]
mov word [rcx + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400084c0
jmp 0x14000854c
lea rcx, str._SYSTEMROOT_SYSTEM32
call fcn.1400a8238
mov rdi, rax
lea rcx, [0x1401254f0]
call fcn.1400a8238
mov rbx, rax
mov rcx, rax
call fcn.1400aa394
mov rdx, rdi
mov rcx, qword [rbp - 0x78]
call fcn.1400a99c0
test rax, rax
je 0x14000850e
mov rdx, rdi
jmp 0x140008522
mov rdx, rbx
mov rcx, qword [rbp - 0x78]
call fcn.1400a99c0
test rax, rax
je 0x140008533
mov rdx, rbx
lea r8, [0x140125700]
lea rcx, [rsp + 0x70]
call fcn.140009c10
mov rcx, rbx
call fcn.1400a82b0
mov rcx, rdi
call fcn.1400a82b0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rbp - 0x78]
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.140013270
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rax]
call fcn.1400a8238
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x78]
call fcn.1400a82b0
mov ecx, 2
call fcn.1400a82f0
mov qword [rbp - 8], rax
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov word [rax], cx
mov rax, qword [rsp + 0x30]
cmp word [rax], cx
je 0x140008c9a
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
call fcn.1400a8238
mov qword [rbp - 0x70], rax
xor r9d, r9d
mov r8d, 0x7fffffff
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x70]
call fcn.140002620
mov ecx, dword [0x1401252dc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, eax
xor r8d, r8d
mov rdx, qword [rbp - 0x70]
mov rcx, qword [0x140119a10]
call fcn.1400075c0
test eax, eax
jne 0x140008656
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, qword [rbp - 0x50]
call fcn.140013970
mov rcx, qword [rbp - 0x50]
test eax, eax
jne 0x140008650
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call fcn.1400a8238
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, qword [rbp - 0x70]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 8]
call fcn.1400a82b0
nop
mov rcx, rbx
jmp 0x140008e52
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call fcn.1400a8238
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rbp - 8]
call fcn.1400a82b0
cmp byte [rsp + 0x40], 0
jne 0x140008b84
cmp byte [0x14012599e], 0
jne 0x140008b84
mov rcx, qword [rsp + 0x30]
call fcn.1400a8238
mov rbx, rax
mov qword [rsp + 0x58], rax
lea rdx, [0x1400d243c]
mov rcx, qword [rsp + 0x30]
call fcn.1400a99c0
test rax, rax
je 0x140008716
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [rbp - 8], eax
test eax, eax
je 0x140008716
mov ecx, eax
inc rcx
lea rax, [rcx + rcx]
mov qword [rsp + 0x38], rax
mov rdx, rax
mov rcx, rbx
call fcn.1400a83a8
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140008702
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.1400a8b00
xor r9d, r9d
mov r8, rbx
mov edx, dword [rbp - 8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp byte [0x14012599e], 0
jne 0x14000892e
lea r9, [rsp + 0x48]
mov r8, rbx
mov rdx, rsi
mov rcx, qword [rbp - 0x60]
call fcn.140013440
test al, al
jne 0x140008917
mov edx, gethostbyaddr
mov rcx, rbx
call fcn.1400a9720
test rax, rax
jne 0x14000892e
or rcx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140008760
cmp rax, 3
jbe 0x14000892e
mov rax, rcx
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x140008780
cmp word [rbx + rax*2 - 8], 0x2e
je 0x14000892e
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov rcx, rbx
call fcn.1400a8238
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x48]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x1400087c1
mov qword [rsp + 0x38], rdx
mov eax, 0x7fffffff
cmp rdx, rax
cmovb rax, rdx
mov qword [rbp - 8], rax
lea rdx, [rdx*2 + 0xc]
call fcn.1400a83a8
mov qword [rsp + 0x48], rax
mov rcx, qword [rbp - 8]
mov r8, qword [rsp + 0x38]
sub r8, rcx
lea r8, [r8*2 + 2]
lea rdx, [rax + rcx*2]
add rcx, 4
lea rcx, [rax + rcx*2]
call fcn.1400a7cd0
mov rax, qword [rsp + 0x48]
movsd xmm0, qword [0x1400d2448]
mov rcx, qword [rbp - 8]
movsd qword [rax + rcx*2], xmm0
cmp byte [0x14012599e], 0
jne 0x1400089be
lea r9, [rsp + 0x30]
mov r8, qword [rsp + 0x48]
mov rdx, rsi
mov rcx, qword [rbp - 0x60]
call fcn.140013440
test al, al
jne 0x1400089be
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov rcx, rbx
call fcn.1400a8238
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x48]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x140008882
mov qword [rsp + 0x38], rdx
mov eax, 0x7fffffff
cmp rdx, rax
cmovb rax, rdx
mov qword [rbp - 8], rax
lea rdx, [rdx*2 + 0xc]
call fcn.1400a83a8
mov qword [rsp + 0x48], rax
mov rcx, qword [rbp - 8]
mov r8, qword [rsp + 0x38]
sub r8, rcx
lea r8, [r8*2 + 2]
lea rdx, [rax + rcx*2]
add rcx, 4
lea rcx, [rax + rcx*2]
call fcn.1400a7cd0
mov rax, qword [rsp + 0x48]
movsd xmm0, qword [0x1400d2458]
mov rcx, qword [rbp - 8]
movsd qword [rax + rcx*2], xmm0
cmp byte [0x14012599e], 0
jne 0x14000892e
lea r9, [rsp + 0x30]
mov r8, qword [rsp + 0x48]
mov rdx, rsi
mov rcx, qword [rbp - 0x60]
call fcn.140013440
test al, al
jne 0x1400089be
jmp 0x14000892e
cmp byte [0x14012599e], 0
jne 0x14000892e
mov rcx, qword [rsp + 0x48]
call fcn.140013360
test al, 0x10
je 0x14000899a
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp word [rcx], 0x20
jne 0x14000894a
nop dword [rax]
add rax, 2
cmp word [rax], 0x20
je 0x140008940
cmp byte [0x14012599e], 0
jne 0x14000896a
mov edx, 0x20
mov rcx, rax
call fcn.1400a9720
test rax, rax
je 0x1400089cb
mov rcx, qword [rsp + 0x30]
mov edx, 0x20
call fcn.1400a9910
test rax, rax
je 0x14000898d
mov edx, 0x20
mov rcx, qword [rsp + 0x30]
call fcn.1400a9910
xor ecx, ecx
mov word [rax], cx
mov rcx, rbx
call fcn.1400a82b0
jmp 0x14000867e
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x48]
call fcn.1400a8238
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400a82b0
nop
mov rcx, rbx
call fcn.1400a82b0
jmp 0x140008b84
mov rdi, qword [rsp + 0x30]
lea rcx, str.File_not_found:
call fcn.1400a8238
mov qword [rsp + 0x30], rax
mov rcx, rdi
call fcn.1400a82b0
xor r9d, r9d
mov r8d, 0x7fffffff
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140002620
mov rcx, qword [rsp + 0x30]
call fcn.1400a8238
mov rdi, rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx + 8]
mov rcx, qword [rax]
call fcn.140013360
cmp eax, 0xffffffff
je 0x140008a59
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
call fcn.140013360
test al, 0x10
je 0x140008a59
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
jmp 0x140008b05
cmp byte [0x14012599e], 0
jne 0x140008b1c
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov r8d, 2
lea rdx, [0x1400d2464]
mov rcx, qword [rax]
call fcn.1400a9818
test eax, eax
jne 0x140008b1c
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
add rcx, 4
call fcn.140013360
cmp eax, 0xffffffff
je 0x140008ab8
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
add rcx, 4
jmp 0x140008b05
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rcx, str.File_not_found:
call fcn.1400a8238
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx + 8]
mov rdx, qword [rax]
add rdx, 4
xor r9d, r9d
mov r8d, 0x7fffffff
lea rcx, [rsp + 0x30]
call fcn.140002620
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.1400a8238
mov rdi, rax
mov rcx, qword [rsp + 0x38]
call fcn.1400a82b0
mov rcx, rdi
call fcn.1400a8238
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, rbx
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400a82b0
nop
mov rcx, rdi
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400a82b0
nop
mov rcx, rsi
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x70]
jmp 0x140008e83
mov rcx, qword [rsp + 0x30]
cmp word [rcx], 0x5c
jne 0x140008bec
cmp word [rcx + 2], 0x5c
je 0x140008bec
mov r9d, 2
lea r8, [0x140124ec0]
lea edx, [r9 + 1]
lea rcx, [rbp - 8]
call fcn.1400a9844
lea r8, [rsp + 0x30]
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x38]
call fcn.1400161f0
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.1400a8238
mov qword [rsp + 0x30], rax
mov rcx, rbx
call fcn.1400a82b0
mov rcx, qword [rsp + 0x38]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x30]
call fcn.1400a8238
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400069b0
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.1400a8238
mov qword [rsp + 0x30], rax
mov rcx, rbx
call fcn.1400a82b0
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
cmp byte [0x14012599e], 0
jne 0x140008c66
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140005fe0
mov rcx, qword [rax]
call fcn.1400a8238
mov rbx, rax
mov qword [rbp - 8], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x38]
jmp 0x140008c81
mov rcx, qword [rsp + 0x30]
call fcn.1400a8238
mov rbx, rax
mov qword [rbp - 8], rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400a82b0
mov rcx, rbx
call fcn.1400aa0e0
nop
mov rcx, qword [rbp - 0x70]
call fcn.1400a82b0
jmp 0x140008c9e
mov rbx, qword [rbp - 8]
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140008ca2
test rax, rax
je 0x140008e31
mov rcx, rbx
call fcn.1400a8238
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x68]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.140006230
mov rcx, qword [rax]
call fcn.1400a8238
mov rbx, rax
mov qword [rbp - 0x28], rax
mov rcx, qword [rbp - 0x80]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140008d00
test rax, rax
je 0x140008dfc
mov ecx, 2
call fcn.1400a82f0
mov qword [rbp - 0x48], rax
xor ecx, ecx
mov word [rax], cx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rcx
lea edx, [rcx + 1]
lea rcx, [rbp - 0x40]
call fcn.140011e90
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140008d60
mov rcx, rbx
call fcn.1400a8238
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov rax, qword [rbp - 0x38]
add rax, 8
mov qword [rbp - 0x38], rax
movzx r9d, byte [rsp + 0x40]
lea r8, [rbp - 0x48]
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.140008210
mov rcx, qword [rbp - 8]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax]
call fcn.1400a8238
mov qword [rbp - 8], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400a82b0
mov rcx, qword [rsp + 0x58]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140008df3
mov rax, qword [rbp - 0x38]
cmp rcx, rax
je 0x140008de0
mov rdi, rcx
mov rbx, rax
mov rcx, qword [rdi]
call fcn.1400a82b0
add rdi, 8
cmp rdi, rbx
jne 0x140008dc2
mov rcx, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x28]
mov rdi, qword [rsp + 0x70]
call fcn.1400a7cb8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
xor eax, eax
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp - 0x48]
call fcn.1400a82b0
mov rcx, qword [rbp - 8]
call fcn.1400a8238
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, qword [rbp - 8]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400a82b0
nop
mov rcx, rbx
jmp 0x140008e67
lea rcx, [0x1400d1428]
call fcn.1400a8238
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rcx, rbx
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x78]
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x80]
call fcn.1400a82b0
nop
mov rcx, rsi
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x68]
call fcn.1400a82b0
nop
mov rcx, rdi
call fcn.1400a82b0
nop
mov rcx, qword [rsp + 0x30]
call fcn.1400a82b0
nop
mov rcx, qword [rbp - 0x58]
call fcn.1400a82b0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x118
pop rdi
pop rsi
pop rbx
pop rbp
ret