joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000864e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rsp + 0x90]
xor edi, edi
mov r15d, r9d
mov r12, r8
mov r14, rdx
mov ebp, edi
test rax, rax
je 0x100086519
mov qword [rax], rdi
mov r13, qword [rsp + 0x98]
test r13, r13
je 0x10008652a
mov qword [r13], rdi
cmp qword [0x10024cd08], rdi
mov qword [rsp + 0x68], rbx
je 0x100086568
movzx ebx, word [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], ebx
mov ebx, dword [rsp + 0x80]
mov rcx, rax
mov r9d, r15d
mov r8, r12
mov rdx, r14
mov dword [rsp + 0x20], ebx
call qword [0x10024cd08]
jmp 0x100086581
mov ebx, dword [rsp + 0x80]
mov r8d, r15d
mov rdx, r12
mov r9d, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1000865cf
call fcn.10006b940
test eax, eax
je 0x100086735
bt r15d, 0x1d
jb 0x100086735
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
mov r9d, r15d
mov dword [rsp + 0x28], eax
mov r8, r12
mov rdx, r14
mov dword [rsp + 0x20], ebx
call fcn.1000879a0
mov rsi, rax
test rax, rax
je 0x100086738
bt r15d, 0xc
jae 0x10008662d
call fcn.10006af10
test r14, r14
je 0x100086611
mov ebx, eax
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [r14 - 1]
add rax, r11
add rax, r12
div r11
xor edx, edx
mov rdi, rax
mov rax, r14
div rbx
imul rdi, r11
imul rax, rbx
sub rdi, rax
jmp 0x10008668b
mov r11d, eax
xor edx, edx
lea rax, [r12 - 1]
add rax, r11
div r11
mov rbp, rax
imul rbp, r11
mov rdi, rbp
jmp 0x10008668b
bt r15d, 0xd
jae 0x10008668b
test r14, r14
je 0x10008666f
call fcn.10006af20
mov ebx, eax
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [r14 - 1]
add rax, r11
add rax, r12
div r11
xor edx, edx
mov rbp, rax
mov rax, r14
div rbx
imul rbp, r11
imul rax, rbx
sub rbp, rax
jmp 0x10008668b
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [r12 - 1]
add rax, r11
div r11
mov rbp, rax
imul rbp, r11
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
mov r8, rdi
mov rdx, rbp
mov qword [rsp + 0x20], r13
call fcn.1000875e0
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000866d3
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000866e4
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10008671b
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100086714
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x210]
test rax, rax
je 0x100086735
add qword [rax + 0x198], rdi
add qword [rax + 0x1a0], rdi
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000867a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, qword [rsp + 0x88]
xor eax, eax
mov rdi, r9
mov r12d, r8d
mov r15, rdx
mov r13, rcx
test r14, r14
je 0x1000867da
mov qword [r14], rax
mov rsi, qword [rsp + 0x90]
test rsi, rsi
je 0x1000867ea
mov qword [rsi], rax
call fcn.10006af10
xor edx, edx
mov r11d, eax
mov rax, r15
div r11
mov rbx, rax
imul rbx, r11
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [rdi - 1]
lea rcx, [r11 + r15]
add rax, rcx
div r11
mov rbp, rax
imul rbp, r11
sub rbp, rbx
call fcn.10006af10
xor edx, edx
mov r11d, eax
mov rax, qword [rsp + 0x80]
mov r8d, r12d
dec rax
lea rcx, [r11 + r15]
add rax, rcx
mov rcx, r15
div r11
mov rdi, rax
mov eax, 0
imul rdi, r11
sub rdi, rbx
cmp r12d, 0x8000
mov rdx, rdi
cmove rdx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x1000868cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp r12d, 0x4000
jne 0x1000868a1
call fcn.10006b720
lea rcx, [0x10001a940]
mov r9d, ebx
mov r8, r15
mov rdx, rdi
call rax
mov eax, 0x80000000
jmp 0x10008698b
cmp r12d, 0x8000
jne 0x1000868c5
call fcn.10006b720
lea rcx, [0x10001a9e0]
mov r9, r15
mov r8, rdi
mov rdx, rbp
mov dword [rsp + 0x20], ebx
call rax
mov eax, 0x80000000
jmp 0x10008698b
mov r8, rdi
neg rbp
mov r9, r14
mov rcx, r13
neg r8
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call fcn.1000875e0
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100086916
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100086927
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10008695e
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100086957
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov rcx, qword [rcx + 0x210]
test rcx, rcx
je 0x100086978
sub qword [rcx + 0x198], rdi
sub qword [rcx + 0x1a0], rdi
mov rcx, qword [0x100278b40]
lea rdx, [rsp + 0x70]
call fcn.1000852a0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100086c00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [rsp + 0x80]
xor r15d, r15d
mov ebx, r9d
mov rax, r8
mov rsi, rdx
mov rbp, rcx
test r14, r14
je 0x100086c37
mov qword [r14], r15
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x100086c47
mov qword [rdi], r15
cmp ebx, 0x8000
mov r8d, ebx
mov rcx, rsi
cmove rax, r15
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x100086cc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0x4000
jne 0x100086c97
call fcn.10006b720
mov rdx, qword [rsp + 0x78]
lea rcx, [0x10001a940]
mov r9d, edi
mov r8, rsi
call rax
mov eax, 0x80000000
jmp 0x100086d8c
cmp ebx, 0x8000
jne 0x100086cbe
call fcn.10006b720
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
lea rcx, [0x10001a9e0]
mov r9, rsi
mov dword [rsp + 0x20], edi
call rax
mov eax, 0x80000000
jmp 0x100086d8c
mov rsi, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov r9, r14
mov r8, rsi
mov rcx, rbp
neg rdx
neg r8
mov qword [rsp + 0x20], rdi
call fcn.1000875e0
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100086d16
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100086d27
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x100086d5e
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100086d57
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov rcx, qword [rcx + 0x210]
test rcx, rcx
je 0x100086d78
sub qword [rcx + 0x198], rsi
sub qword [rcx + 0x1a0], rsi
mov rcx, qword [0x100278b40]
lea rdx, [rsp + 0x68]
call fcn.1000852a0
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x100086db0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rsp + 0x98]
xor edi, edi
mov r15d, r9d
mov r12, r8
mov r14, rdx
mov ebp, edi
test rax, rax
je 0x100086de9
mov qword [rax], rdi
mov r13, qword [rsp + 0xa0]
test r13, r13
je 0x100086dfa
mov qword [r13], rdi
cmp qword [0x10024cd08], rdi
mov qword [rsp + 0x68], rbx
je 0x100086e38
movzx ebx, word [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], ebx
mov ebx, dword [rsp + 0x80]
mov rcx, rax
mov r9d, r15d
mov r8, r12
mov rdx, r14
mov dword [rsp + 0x20], ebx
call qword [0x10024cd08]
jmp 0x100086e51
mov ebx, dword [rsp + 0x80]
mov r8d, r15d
mov rdx, r12
mov r9d, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x100086ea5
call fcn.10006b940
test eax, eax
je 0x100087013
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1e7
je 0x100087013
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
mov r9d, r15d
mov dword [rsp + 0x28], eax
mov r8, r12
mov rdx, r14
mov dword [rsp + 0x20], ebx
call fcn.1000879a0
mov rsi, rax
test rax, rax
je 0x100087016
bt r15d, 0xc
jae 0x100086f0b
call fcn.10006af10
test r14, r14
je 0x100086eef
mov ebx, eax
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [r14 - 1]
add rax, r11
add rax, r12
div r11
xor edx, edx
mov rdi, rax
mov rax, r14
div rbx
imul rdi, r11
imul rax, rbx
sub rdi, rax
sub rdi, qword [rsp + 0x90]
jmp 0x100086f69
mov r11d, eax
xor edx, edx
lea rax, [r12 - 1]
add rax, r11
div r11
mov rbp, rax
imul rbp, r11
mov rdi, rbp
jmp 0x100086f69
bt r15d, 0xd
jae 0x100086f69
test r14, r14
je 0x100086f4d
call fcn.10006af20
mov ebx, eax
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [r14 - 1]
add rax, r11
add rax, r12
div r11
xor edx, edx
mov rbp, rax
mov rax, r14
div rbx
imul rbp, r11
imul rax, rbx
sub rbp, rax
jmp 0x100086f69
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [r12 - 1]
add rax, r11
div r11
mov rbp, rax
imul rbp, r11
mov r9, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x60]
mov r8, rdi
mov rdx, rbp
mov qword [rsp + 0x20], r13
call fcn.1000875e0
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100086fb1
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100086fc2
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100086ff9
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100086ff2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x210]
test rax, rax
je 0x100087013
add qword [rax + 0x198], rdi
add qword [rax + 0x1a0], rdi
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100087350
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov r15, rcx
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [rbx - 1]
add rax, r11
div r11
mov rbp, rax
imul rbp, r11
call fcn.10006af10
xor edx, edx
mov r11d, eax
lea rax, [rdi - 1]
mov rdi, qword [rsp + 0x70]
add rax, r11
div r11
mov rsi, rax
imul rsi, r11
test rdi, rdi
je 0x1000873bb
mov qword [rdi], 0
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x1000873cc
mov qword [rbx], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x10008749b
mov r8, rsi
neg rbp
mov r9, rdi
mov rcx, r15
neg r8
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call fcn.1000875e0
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100087424
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100087435
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x10008746c
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100087465
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
mov rcx, qword [rcx + 0x210]
test rcx, rcx
je 0x100087486
sub qword [rcx + 0x198], rsi
sub qword [rcx + 0x1a0], rsi
mov rcx, qword [0x100278b40]
lea rdx, [rsp + 0x70]
call fcn.1000852a0
xor eax, eax
jmp 0x1000874c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.10006b720
lea rcx, [0x10001aba0]
mov r9, r14
mov r8, rsi
mov rdx, rbp
mov dword [rsp + 0x20], ebx
call rax
mov eax, 0x80000000
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x100089490
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x78
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop word [rax + rax]
mov ecx, dword [0x1002562e0]
test cl, 1
jne 0x1000894da
lea edx, [rcx + 1]
mov eax, ecx
lock cmpxchg dword [0x1002562e0], edx
je 0x1000894de
pause
jmp 0x1000894c0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
add ecx, 2
movaps xmmword [0x1002562a0], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [0x1002562b0], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [0x1002562c0], xmm0
movaps xmmword [0x1002562d0], xmm1
mov dword [0x1002562e0], ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.10005f420
add rsp, 0x78
ret

Function at 0x100089d00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100089d35
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100089d46
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100089d7d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100089d76
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov eax, dword [rax + 0x220]
mov rbx, qword [rsp + 0x30]
shr eax, 6
and eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x100089da0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100089dd5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100089de6
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x100089e1d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100089e16
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov eax, dword [rax + 0x220]
mov rbx, qword [rsp + 0x30]
shr eax, 5
and eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x100089e40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, r9d
mov r15d, r8d
movsxd rsi, edx
mov rbx, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100089e8f
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100089ea0
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
jne 0x100089ed7
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100089ed0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [rdi + 0xd8]
mov rcx, qword [rcx + 0x210]
test rcx, rcx
je 0x100089f19
cmp r15d, 1
jne 0x100089f0b
cmp esi, 5
jge 0x100089f0b
add qword [rcx + rsi*8 + 0x170], rbx
cmp esi, r15d
jne 0x100089f12
cmp r14d, 0x40
je 0x100089f12
add qword [rcx + r14*8 + 0x1a8], rbx
jmp 0x100089f12
add qword [rcx + 0x198], rbx
add qword [rcx + 0x1a0], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x100089f40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, r9d
mov r15d, r8d
movsxd rsi, edx
mov rbx, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100089f8f
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100089fa0
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
jne 0x100089fd7
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbp, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100089fd0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [rdi + 0xd8]
mov rcx, qword [rcx + 0x210]
test rcx, rcx
je 0x10008a019
cmp r15d, 1
jne 0x10008a00b
cmp esi, 5
jge 0x10008a00b
sub qword [rcx + rsi*8 + 0x170], rbx
cmp esi, r15d
jne 0x10008a012
cmp r14d, 0x40
je 0x10008a012
sub qword [rcx + r14*8 + 0x1a8], rbx
jmp 0x10008a012
sub qword [rcx + 0x198], rbx
sub qword [rcx + 0x1a0], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x10008a040
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10008a075
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x10008a086
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10008a0bd
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x10008a0b6
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x1f0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x100092c60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx]
mov rbp, r8
mov r15d, edx
mov r14, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100092caf
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x100092cc0
mov rdx, qword [rdi + 0xd8]
test rdx, rdx
jne 0x100092cf7
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x100092cf0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rdx, qword [rdi + 0xd8]
mov rax, qword [rbx + 0x28]
xor r9d, r9d
mov r8d, 0x3e8
mov ecx, r9d
cmp qword [rdx + 0x218], rax
jne 0x100092d1b
test byte [rdx + 0x2d8], 4
cmove r8d, r9d
cmp rdx, qword [rbx + 0x18]
je 0x100092d7f
mov ecx, r9d
xor eax, eax
lock cmpxchg qword [rbx + 0x18], rdx
jne 0x100092d55
mov rax, qword [rdx + 0x218]
mov qword [rbx + 0x30], 1
mov qword [rbx + 0x28], rax
mov rax, qword [rdx + 0x210]
mov qword [rbx + 0x20], rax
mov qword [rdx + 0xd0], r9
jmp 0x100092d5a
mov ecx, 0x80000000
test ecx, ecx
je 0x100092d83
mov rax, r8
dec r8
test rax, rax
jg 0x100092d21
mov r9, rbp
mov r8d, r15d
mov rcx, rbx
call fcn.100083de0
mov ecx, eax
test eax, eax
je 0x100092d83
jmp 0x100092d89
inc qword [rbx + 0x30]
inc dword [r14 + 8]
mov eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1000938e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov rsi, rcx
test r8, r8
jne 0x10009399e
mov qword [rsp + 0x30], rdi
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100093930
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100093941
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100093978
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100093971
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rbx, qword [rbx + 0x218]
mov rdi, qword [rsp + 0x30]
test rbx, rbx
jne 0x10009399e
mov eax, 0x80000000
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rbx + 0xad0]
mov r8d, ebp
mov rdx, rsi
call fcn.100105bb0
mov qword [rsi + 0x20], rax
test rax, rax
je 0x1000939d7
lea rcx, [rbx + 0x40]
mov rdx, rax
call fcn.1000936e0
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov eax, 0xc0000000
add rsp, 0x20
pop rsi
ret

Function at 0x1000961c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000961f5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100096206
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x10009623d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100096236
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov eax, dword [rax + 0x7c]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100096a00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100096a4b
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100096a5c
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100096a93
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100096a8c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rsi, qword [rbx + 0x3f8]
lea rax, [0x1000610e0]
mov rdx, rbx
mov rcx, r14
mov qword [rbx + 0x3f8], rax
call fcn.100098430
mov rdx, rbp
mov rcx, r14
call fcn.100110b90
mov qword [r14 + 0x4c8], 0
mov edx, 0xffff7fff
mov ebp, eax
lock xadd dword [r14 + 0x4a8], edx
cmp edx, 0x8001
je 0x100096afb
lea rcx, [r14 + 0x480]
call fcn.1000931d0
lea rcx, [r14 + 0x458]
call fcn.1000931d0
mov eax, ebp
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov qword [rbx + 0x3f8], rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x100096b30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100096b72
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x100096b83
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x100096bba
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x100096bb3
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rsi, qword [rbx + 0x3f8]
lea rax, [0x1000610e0]
mov rdx, rbx
mov rcx, rbp
mov qword [rbx + 0x3f8], rax
call fcn.100098430
mov rcx, rbp
call fcn.100110c00
mov qword [rbp + 0x4c8], 0
mov eax, 0xffff7fff
lock xadd dword [rbp + 0x4a8], eax
cmp eax, 0x8001
je 0x100096c19
lea rcx, [rbp + 0x480]
call fcn.1000931d0
lea rcx, [rbp + 0x458]
call fcn.1000931d0
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 0x3f8], rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret