joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cf6d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebp, ecx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cf711
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000cf722
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x1000cf759
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cf752
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rbx, qword [rbx + 0x210]
lea rsi, [rbx + 0x90]
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rsi], edx
je 0x1000cf77e
mov rcx, rsi
call fcn.100057ac0
xor edi, edi
cmp dword [rbx + 0xb8], ebp
jg 0x1000cf7ae
lock and dword [rbx + 0xb4], 0xfffffffb
mov dword [rbx + 0xb8], edi
cmp qword [rbx + 0x140], rdi
je 0x1000cf7ae
mov rcx, qword [rbx + 0xa0]
mov rdx, rbx
call fcn.100066a70
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov dword [rsi], edi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1000cf800
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cf835
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000cf846
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000cf87d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cf876
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rbx, qword [rax + 0x210]
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x90], edx
je 0x1000cf8a3
lea rcx, [rbx + 0x90]
call fcn.100057ac0
lock and dword [rbx + 0xb4], 0xfffffffe
xor eax, eax
mov dword [rbx + 0x90], eax
mov dword [rbx + 0x104], eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1000cf8d0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cf916
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000cf927
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x1000cf95f
call fcn.100063d30
call fcn.100068a00
mov rdi, rax
mov rcx, qword gs:[0x30]
lea rbx, [rcx + rax]
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cf958
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rax, qword [rbx + 0x228]
or dword [rbx + 0x2d8], 0x40000
or dword [rax + 0xe0], 8
call fcn.10006af50
test eax, eax
jne 0x1000cfa1d
mov eax, dword [rbx + 0x2d8]
test al, 4
je 0x1000cf998
bt eax, 0xc
jae 0x1000cfa1d
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.100057f20
nop
mov edx, 0x20000182
mov r8d, 1
lea rcx, [rsp + 0x40]
call fcn.1000580b0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0xa0], rax
cmp dword [rsp + 0x40], 0
je 0x1000cfa01
cmp dword [rsp + 0x44], 0
je 0x1000cf9ea
mov rax, qword [rsp + 0x48]
or dword [rax + 0x2d8], 0x800
jmp 0x1000cfa01
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov r8d, 1
mov rdx, qword [rsp + 0x48]
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0x58]
call fcn.100057e00
nop
mov rcx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
not eax
and dword [rcx + 0x220], eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret

Function at 0x1000cfa90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cfac5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000cfad6
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000cfb0d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cfb06
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rdi, qword [rax + 0x210]
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rdi + 0x90], edx
je 0x1000cfb33
lea rcx, [rdi + 0x90]
call fcn.100057ac0
lock and dword [rdi + 0xb4], 0xffffffef
mov dword [rdi + 0x90], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1000cfc60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rcx
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbx, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000cfcb2
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000cfcc3
mov rdi, qword [rdi + 0xd8]
test rdi, rdi
jne 0x1000cfcfa
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rbx, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000cfcf3
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rdi, qword [rdi + 0xd8]
call fcn.10011b7d0
test eax, eax
je 0x1000cfd15
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x20]
jmp 0x1000cfd1d
mov rbx, qword [0x7ffe0008]
mov qword [rdi + 0xb0], rbx
call fcn.10006bc70
test eax, eax
je 0x1000cfdb8
mov r8, qword [rdi + 0x218]
mov edx, dword [rsi]
test r8, r8
je 0x1000cfd54
movzx ecx, dx
add rcx, 0xa5
lea rax, [rcx + rcx*2]
add rax, rax
inc qword [r8 + rax*8]
mov rcx, rdi
call fcn.1000653d0
mov qword [rdi + 0xb8], rbx
mov qword [rdi + 0xc0], rbx
call fcn.100072610
test eax, eax
je 0x1000cfdb8
lea rcx, [rsp + 0x30]
call fcn.1000725c0
movzx edx, word [rsi]
lea rcx, [rsp + 0x30]
call fcn.100072630
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.100072640
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.100072650
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.100072660
lea rcx, [rsp + 0x30]
call fcn.100072670
mov rbx, qword [rdi + 0x210]
test rbx, rbx
je 0x1000cfdfb
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x90], edx
je 0x1000cfde3
lea rcx, [rbx + 0x90]
call fcn.100057ac0
add dword [rbx + 0x100], 2
mov qword [rbx + 0xc0], rsi
mov dword [rbx + 0x90], 0
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.10005f420
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1000cfe30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cfe72
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000cfe83
mov rbx, qword [rbx + 0xd8]
test rbx, rbx
jne 0x1000cfeba
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cfeb3
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rbx, qword [rbx + 0xd8]
mov rcx, qword [rbx + 0x218]
test rcx, rcx
je 0x1000cfed4
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
call fcn.1000d7370
mov rdi, qword [rbx + 0x210]
xor ebp, ebp
mov qword [rbx + 0xb0], rbp
test rdi, rdi
je 0x1000cff1c
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rdi + 0x90], edx
je 0x1000cff08
lea rcx, [rdi + 0x90]
call fcn.100057ac0
add dword [rdi + 0x100], 2
mov qword [rdi + 0xc0], rbp
mov dword [rdi + 0x90], ebp
mov rsi, qword [rsp + 0x48]
mov qword [rbx + 0x3c0], rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1000cff40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000cff7a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000cff8b
mov rsi, qword [rbx + 0xd8]
test rsi, rsi
jne 0x1000cffc2
call fcn.100063d30
call fcn.100068a00
mov rsi, qword gs:[0x30]
mov rcx, rax
mov rbx, rax
add rsi, rax
call fcn.10006c530
test eax, eax
jne 0x1000cffbb
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rsi, qword [rsi + 0xd8]
call fcn.10011b7d0
test eax, eax
je 0x1000cffdd
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x30]
jmp 0x1000cffe5
mov rbx, qword [0x7ffe0008]
mov rax, qword [rsi + 0x218]
mov rdi, qword [rax + 0xab0]
call fcn.10006af30
xor edx, edx
mov r11, rax
mov rax, rdi
div r11
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000d0011
or rcx, rax
jmp 0x1000d0053
call fcn.10011b7d0
test eax, eax
je 0x1000d0049
call fcn.10011b7f0
mov rcx, rax
movabs rax, 0x624dd2f1a9fbe77
imul rcx, rdi
add rcx, 0x3e7
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
jmp 0x1000d0053
mov rcx, rdi
imul rcx, rcx, 0x2710
mov rax, qword [rsi + 0x2f0]
add rax, rcx
cmp rbx, rax
jbe 0x1000d0078
sub rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1000d0b90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d0bc5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000d0bd6
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000d0c0d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d0c06
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x388]
test rax, rax
je 0x1000d0c2b
mov rax, qword [rax + 0xf8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000d3240
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x10022f440]
xor rax, rsp
mov qword [rsp + 0x290], rax
inc dword [rcx + 0x10]
inc dword [rcx + 0x14]
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1000d327b
mov qword [rcx], rdx
jmp 0x1000d3283
mov rax, qword [rcx + 8]
mov qword [rax + 0x20], rdx
mov qword [rcx + 8], rdx
mov qword [rdx + 0x20], 0
call fcn.10011b7d0
test eax, eax
je 0x1000d32ae
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x20]
mov qword [rdi + 0x48], r11
jmp 0x1000d32ba
mov rax, qword [0x7ffe0008]
mov qword [rdi + 0x48], rax
dec dword [rbx + 0x10]
call fcn.10006d280
test eax, eax
je 0x1000d331b
lea rcx, [rsp + 0x30]
call fcn.10006d230
mov edx, dword [rdi + 0x14]
mov eax, dword [rdi + 0x10]
shl rdx, 0x20
lea rcx, [rsp + 0x30]
and rdx, rax
call fcn.10006d2a0
mov rdx, qword [rdi + 0x28]
lea rcx, [rsp + 0x30]
call fcn.10006d2b0
mov rdx, qword [rdi + 0x38]
lea rcx, [rsp + 0x30]
call fcn.10006d2c0
mov rdx, qword [rdi + 0x40]
lea rcx, [rsp + 0x30]
call fcn.10006d2d0
lea rcx, [rsp + 0x30]
call fcn.10006d2e0
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000d3346
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000d3357
mov r8, qword [rdi + 0xd8]
test r8, r8
jne 0x1000d338e
call fcn.100063d30
call fcn.100068a00
mov rdi, qword gs:[0x30]
mov rcx, rax
mov rsi, rax
add rdi, rax
call fcn.10006c530
test eax, eax
jne 0x1000d3387
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov r8, qword [rdi + 0xd8]
xor edx, edx
mov rcx, rbx
call fcn.1000d33d0
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.10005f420
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, edx
mov rsi, rcx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e8785
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000e8796
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
jne 0x1000e87cd
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000e87c6
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rcx, qword [rbx + 0xd8]
inc dword [rcx + 0x8c]
mov rdx, qword [rcx + 0x218]
mov eax, dword [rsi + 0x30]
add qword [rcx + 0x90], rax
mov eax, 0xa3ca
lea rcx, [rbp*2 + 0x1fa]
add rcx, rbp
mov word [rsi + 0x50], ax
lea rcx, [rdx + rcx*8]
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x1000d3240
Function at 0x1000d33d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rsi, r8
mov r15d, edx
mov rbx, rcx
cmp qword [rcx], 0
jne 0x1000d340b
xor eax, eax
jmp 0x1000d3647
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x30], r12d
or dword [r8 + 0x220], 0x40
inc dword [rcx + 0x10]
mov eax, dword [rcx + 0x10]
cmp eax, 1
je 0x1000d344f
mov qword [rsp + 0x20], r12
mov r9d, 0x13a3
lea r8, [0x1004df2e0]
lea rdx, [0x1004df430]
lea ecx, [r12 + 1]
call fcn.1001522c0
nop
xor edx, edx
lea rax, [fcn.100062040]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x70]
call fcn.10005b410
nop
mov r13d, 0xa3ca
mov rax, qword [rsp + 0x40]
nop dword [rax]
test rax, rax
je 0x1000d348b
mov rax, qword [rax + 0x20]
jmp 0x1000d348e
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1000d358d
cmp dword [rax], 0x103
je 0x1000d357e
lea r14, [rax + 0x50]
mov qword [rsp + 0x48], r14
movzx eax, word [r14]
cmp ax, r13w
je 0x1000d34de
mov qword [rsp + 0x20], r12
mov r9d, 0x13ac
lea r8, [0x1004df2e0]
lea rdx, [0x1004df440]
mov ecx, 1
call fcn.1001522c0
mov rdi, qword [rsp + 0x38]
lea r8, [rdi + 0x30]
xor r9d, r9d
mov rdx, rdi
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1000d350b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x108], eax
mov dword [rdi + 0x34], eax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rdi + 0x20]
test rcx, rcx
jne 0x1000d351e
mov qword [rbx], rax
jmp 0x1000d352c
mov qword [rcx + 0x20], rax
cmp qword [rbx + 8], rdi
jne 0x1000d352c
mov qword [rbx + 8], rcx
dec dword [rbx + 0x14]
or dword [rsi + 0x2d8], 0x2000
call fcn.10006d450
mov rdi, qword [rsp + 0x38]
test eax, eax
je 0x1000d354f
mov rcx, rdi
call fcn.1000d3660
mov qword [rsp + 0x68], r14
mov word [r14], r12w
mov rcx, rdi
call qword [rdi + reloc.WS2_32.dll_getservbyport]
mov r11d, dword [rsi + 0x2d8]
mov eax, r11d
btc eax, 0xd
and eax, r11d
mov dword [rsi + 0x2d8], eax
inc dword [rsp + 0x30]
jmp 0x1000d3474
test r15d, r15d
je 0x1000d358d
mov qword [rsp + 0x40], rax
jmp 0x1000d3480
lea rcx, [rsp + 0x70]
call fcn.10005b4f0
nop
jmp 0x1000d35aa
call fcn.100068a00
mov r14, rax
mov rdi, qword gs:[0x30]
add rdi, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d35d6
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rdi, rdi
je 0x1000d35e7
mov rax, qword [rdi + 0xd8]
test rax, rax
jne 0x1000d361f
call fcn.100063d30
call fcn.100068a00
mov r14, rax
mov rdi, qword gs:[0x30]
add rdi, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d3618
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rax, qword [rdi + 0xd8]
cmp dword [rax + 0x204], 0
je 0x1000d362d
call fcn.1000618f0
mov eax, dword [rsi + 0x220]
mov ecx, eax
xor ecx, 0x40
and ecx, eax
mov dword [rsi + 0x220], ecx
dec dword [rbx + 0x10]
mov eax, dword [rsp + 0x30]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1000d4e00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d4e35
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000d4e46
mov rax, qword [rbx + 0xd8]
test rax, rax
jne 0x1000d4e7d
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d4e76
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov rax, qword [rbx + 0xd8]
mov rax, qword [rax + 0x210]
lock inc dword [rax + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1000d53c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov qword [rdx], 0xffffffffffffffff
call fcn.10011b7d0
test eax, eax
je 0x1000d53f2
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x30]
jmp 0x1000d53fa
mov r11, qword [0x7ffe0008]
mov rdx, qword [rdi + 8]
cmp rdx, rdi
je 0x1000d540e
test rdx, rdx
je 0x1000d540e
add rdx, 0xfffffffffffffff8
jmp 0x1000d5410
xor edx, edx
test rdx, rdx
je 0x1000d5467
mov rcx, qword [rdx + 0x28]
test rcx, rcx
je 0x1000d544c
mov rax, qword [rdx + 0x20]
mov r8, qword [rdx + 0x18]
cmp rax, r8
jb 0x1000d5430
sub rax, r8
jmp 0x1000d5432
xor eax, eax
add rax, rcx
je 0x1000d544c
cmp r11, rax
ja 0x1000d549f
mov rcx, qword [rbx]
sub rax, r11
cmp rcx, rax
cmova rcx, rax
mov qword [rbx], rcx
mov rdx, qword [rdx + 0x10]
cmp rdx, rdi
je 0x1000d5460
test rdx, rdx
je 0x1000d5460
add rdx, 0xfffffffffffffff8
jmp 0x1000d5462
xor edx, edx
test rdx, rdx
jne 0x1000d5415
mov rax, qword [rbx]
test rax, rax
je 0x1000d54bf
cmp rax, 0xffffffffffffffff
je 0x1000d54bf
call fcn.10011b7d0
test eax, eax
je 0x1000d54b4
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x38]
mov rax, rbx
add qword [rbx], r11
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rbx], 0
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r11, qword [0x7ffe0008]
add qword [rbx], r11
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1000d54f0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [rcx + 0x2d8]
test al, 4
je 0x1000d5505
bt eax, 0xc
jb 0x1000d5505
jmp fcn.1000da490
mov r8d, edx
mov rdx, rcx
mov rcx, qword [rcx + 0x218]
jmp fcn.1000da690
Function at 0x1000d5520
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov ebx, r8d
mov ebp, edx
mov rdi, rcx
call fcn.10011b7d0
test eax, eax
je 0x1000d555f
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x20]
jmp 0x1000d5567
mov r11, qword [0x7ffe0008]
mov qword [rsp + 0x28], r11
lea r8, [rsp + 0x28]
mov edx, ebx
mov rcx, rdi
call fcn.1000db3d0
mov r11d, dword [rdi + 0x2d8]
test r11b, 4
je 0x1000d55da
bt r11d, 0xc
jb 0x1000d55da
mov rsi, qword [rdi + 0x228]
call fcn.100068a00
mov rdi, rax
mov rbx, qword gs:[0x30]
add rbx, rax
mov rcx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d55c1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov qword [rsi + 0xd0], rbx
mov rcx, qword [rsi + 0x110]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1000d5675
mov rbx, qword [rdi + 0x218]
call fcn.100064800
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0xae8], edx
mov ecx, 0
sete cl
test ecx, ecx
jne 0x1000d560a
lea rcx, [rbx + 0xae8]
call fcn.1000d2ce0
cmp dword [rbx + 0x10a0], 0
jne 0x1000d562a
mov eax, dword [rbx + 0xaec]
test eax, eax
je 0x1000d5626
cmp dword [rbx + 0xaf0], 0
je 0x1000d562a
xor esi, esi
jmp 0x1000d562f
mov esi, 1
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call fcn.1000db630
mov dword [rbx + 0xae8], 0
test esi, esi
je 0x1000d5675
lea rcx, [rsp + 0x60]
call fcn.1000d2450
nop
mov rcx, qword [rbx + 0xae0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lock inc qword [rbx + 0x70d0]
lea rcx, [rsp + 0x60]
call fcn.1000d2460
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1000d62d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
movsxd rbp, ecx
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d6314
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rbx, rbx
je 0x1000d6325
mov r8, qword [rbx + 0xd8]
test r8, r8
jne 0x1000d635c
call fcn.100063d30
call fcn.100068a00
mov rbx, qword gs:[0x30]
mov rcx, rax
mov rdi, rax
add rbx, rax
call fcn.10006c530
test eax, eax
jne 0x1000d6355
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
mov r8, qword [rbx + 0xd8]
mov rax, qword [r8 + 0x218]
lea rcx, [rbp*2]
add rbp, 0x1fa
add rcx, rbp
mov edx, esi
lea rcx, [rax + rcx*8]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1000d33d0
Function at 0x1000d7e40
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov rcx, qword [rcx + 8]
mov r9d, edx
cmp rcx, rax
je 0x1000d7e88
test rcx, rcx
je 0x1000d7e88
cmp rcx, qword [rax]
jne 0x1000d7e80
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov qword [rdx], rax
xor eax, eax
mov edx, r9d
mov qword [rcx + 8], rax
mov qword [rcx], rax
add rsp, 0x28
jmp fcn.1000d5520
mov rcx, rax
call fcn.1000db170
add rsp, 0x28
ret